Subject: [Hipsec] Moving NES_INFO before Diffie-Hellman

From: [email-masked] (Ahrenholz, Jeffrey M)
Date: Tue Feb 3 11:04:01 2004

This change seems ok. It looks like the middlebox will also be scanning
through and picking out the signature to validate the packet (sec 7.5)
otherwise attackers could spoof UPDATE packets. This change would align
with sec 7.3 of the -mm-02 draft.

-Jeff

> > I'd like to move the NES_INFO parameter so that it always preceeds
the=20
> > Diffie-Hellman parameter.  That would make middlebox implementation=20
> > slightly easier, since middle-boxes need  to track NES_INFO  but
they=20
> > do not need to care about Diffie-Hellman.
> >=20
> > The change would also make it easier to include several
> > REA parameters in a single NES packet.
> >=20